Commerce over the Internet has become very popular. Such commerce takes many forms, from purchasing merchandize from online vendors to conducting online banking and stock trading. Common to all such transactions is the need to transmit private secure information. Typically, the transactions are carried out using secure encrypted connections. However, there are still opportunities to capture the private information that is used during online transactions, for example, to obtain passwords, Personal Identification Numbers (PIN), social security numbers, driver's license numbers and account numbers, to name a few. Illegal procurement of such information and using the same in a fraudulent manner is commonly referred to as identity theft.
While the Internet is by far the largest and most pervasive computer network, the problem of identity theft occurs in other networks as well. For example, identity theft can occur entirely within the confines of a corporate network or a university network wherein a dishonest individual uses a transaction within the network to steal PINs enabling access to confidential information.
Many of the current security mechanisms assume that a user's computer and its keyboard are secure, which is incorrect. One form of conducting online identity theft is to use a keystroke logger to log individual keystrokes for extracting personal information. The keystroke logger is, for example, software installed on a computer without the user's knowledge and its operation is invisible to the user. The keystroke logger in the form of software is, for example, distributed and installed remotely—for example, in the form of malware—and transmits the key logs to a remote computer in an invisible fashion. Numerous anti-virus programs fight known malicious software programs and try to keep up with the proliferation of new malicious software programs.
It is desirable to provide a system for secure provision of key credential information to a server via an un-trusted computer.
It is also desirable to provide a system for secure provision of key credential information that is easily installed in an existing computer system.